topic Re: question re split tunnelling in General Topics

question re split tunnelling

sue_town — Thu, 23 Jun 2011 14:20:29 GMT

We are installing some PA 500 firewalls at various sites within our company

each site has 1 connection to the internet - my question is if I want to install a dynamic multipoint VPN tunnel to connect this site to the company network and all traffic will use this - apart from internet traffic which will be pushed out locally - do I need one or two ISP circuits to do this?

thanks for any help

Sue

Re: question re split tunnelling

mrajdev — Thu, 23 Jun 2011 20:34:47 GMT

Sue,

You can do this using one ISP circuit. This ISP circuit will be used to connect the IPSec VPN tunnel to the head office. You can have a route on the remote location to send the traffic which belongs to the head office network over the VPN tunnel. All other traffic would go out to the internet using the default route to the ISP router.

Hope this helps, Do please let us know if you have any other questions.

Thanks

Re: question re split tunnelling

sue_town — Fri, 24 Jun 2011 13:31:46 GMT

thanks for the reply and info - we are currently using CISCO routers to build the IPSEC GRE tunnels - would i still need to use the CISCO router to do this with the PA 500 firewall - or just the PA 500?

thanks

Re: question re split tunnelling

mrajdev — Fri, 24 Jun 2011 22:33:04 GMT

Hi Sue,

You cannot terminate the GRE tunnel on a PAN as of now, but you can terminate a IPSec tunnel on a PAN. So if you have a PA-500 to PA-500 IPSec will work with no problems. If you want you can also do a IPSec tunnel between a Cisco router and a PA-500. Below is the example of how the network would look like if you are doing a GRE tunnel and using a IPSec tunnel to encrypt the GRE tunnel traffic.

Cisco Cisco

Router-----------------Router ===========Pa-500 --------------Cisco Router

GRE IPSec Tunnel GRE

Hope this help, do please let us know if you have any further questions.

Thanks